Daily Cross-Stack Compliance Audit with OPA

Run a recurring, cross-stack compliance audit that treats Open Policy Agent (OPA) as the single source of truth for what "compliant" means. This blueprint collects real configuration facts from AWS and Kubernetes, sends them to OPA as the input document for a central policy, and notifies Slack the moment the decision returns any violations. Instead of scattering compliance checks across cloud-native tools, IaC linters, and ad hoc scripts, you evaluate everything against one declarative policy and get a single, auditable verdict with a decision ID you can trace.

How it works

1. collect_aws runs io.kestra.plugin.aws.cli.AwsCLI to gather AWS facts, here listing S3 bucket names with aws s3api list-buckets.
2. collect_k8s runs io.kestra.plugin.kubernetes.kubectl.Get with resourceType: deployments and fetchType: FETCH to pull the Deployments in the audited namespace (inputs.k8s_namespace, default production).
3. evaluate runs io.kestra.plugin.ee.opa.policy.Evaluate against policyPath (inputs.opa_policy_path, default compliance/violations), passing the collected facts as the OPA input document.
4. alert_on_violations is an io.kestra.plugin.core.flow.If that checks whether outputs.evaluate.result is non-empty and, when it is, runs notify_violations to post a summary and the OPA decisionId to Slack via io.kestra.plugin.slack.notifications.SlackIncomingWebhook.
5. A io.kestra.plugin.core.trigger.Schedule trigger (daily_audit, cron 0 7 * * *, shipped disabled) runs the audit every morning once you enable it.

What you get

• One policy, many stacks: AWS and Kubernetes evaluated against the same OPA rules.
• Actionable alerts: Slack messages that include the violation count and the OPA decision ID.
• Traceable decisions: a decisionId for every evaluation when OPA decision logging is on.
• A scheduled, hands-off audit that runs daily without manual triggering.

Who it's for

• Platform and DevOps engineers enforcing guardrails across clouds and clusters.
• Security and compliance teams that need continuous, auditable policy checks.
• SREs who want violations surfaced in Slack before they become incidents.

Why orchestrate this with Kestra

OPA evaluates policy but does not schedule, gather facts, or notify on its own. Kestra fills that gap: an event or schedule trigger drives the audit, retries handle transient AWS or Kubernetes API failures, and full execution lineage records exactly which facts produced which decision. The entire pipeline is declarative YAML you can version, review, and reuse, so the fact collection, policy evaluation, and alerting live together instead of in disconnected cron jobs and scripts.

Prerequisites

• An OPA server reachable from Kestra with a policy whose data path returns a violations list.
• AWS credentials with permission to list the resources you audit.
• Kubernetes API access to the audited namespace.

Secrets

• AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION: AWS access for the CLI step.
• K8S_MASTER_URL, K8S_TOKEN: Kubernetes API access for kubectl.
• OPA_URL, OPA_TOKEN: OPA server URL and token (set via pluginDefaults).
• SLACK_WEBHOOK_URL: Slack incoming webhook URL.

Quick start

1. Add the secrets above to your Kestra namespace.
2. Load an OPA policy whose data path (set by opa_policy_path) returns a violations array.
3. Set k8s_namespace to the namespace you want to audit.
4. Run the flow, then enable the daily_audit trigger to run it on a schedule.

How to extend

• Add more AWS facts (extra aws CLI calls) or other kubectl resource types as your policy grows.
• Collect facts from other providers (GCP, Azure, databases) and merge them into the OPA input.
• Tune the If condition and Slack payload to match your policy's output shape.
• Route violations to PagerDuty, GitHub issues, or a ticketing system in addition to Slack.

Links

• Plugin docs: https://kestra.io/plugins/plugin-ee-opa
• Orchestrate OPA with Kestra: https://kestra.io/orchestration/opa